pi-soly 1.9.3 → 1.11.0

package/mcp/__tests__/errors.upstream-test.ts

@@ -0,0 +1,218 @@
+import { describe, it, expect } from "vitest";
+import {
+  McpUiError,
+  ResourceFetchError,
+  ResourceParseError,
+  BridgeConnectionError,
+  ConsentError,
+  SessionError,
+  ServerError,
+  McpServerError,
+  wrapError,
+  isErrorCode,
+} from "../errors.ts";
+
+describe("McpUiError", () => {
+  it("creates error with required fields", () => {
+    const error = new McpUiError("test message", { code: "TEST_ERROR" });
+
+    expect(error.message).toBe("test message");
+    expect(error.code).toBe("TEST_ERROR");
+    expect(error.name).toBe("McpUiError");
+    expect(error.context).toEqual({});
+  });
+
+  it("includes optional fields", () => {
+    const cause = new Error("root cause");
+    const error = new McpUiError("test", {
+      code: "TEST",
+      context: { server: "test-server" },
+      recoveryHint: "Try again",
+      cause,
+    });
+
+    expect(error.context.server).toBe("test-server");
+    expect(error.recoveryHint).toBe("Try again");
+    expect(error.cause).toBe(cause);
+  });
+
+  it("serializes to JSON", () => {
+    const error = new McpUiError("test", {
+      code: "TEST",
+      context: { server: "s1" },
+      recoveryHint: "hint",
+    });
+
+    const json = error.toJSON();
+    expect(json.name).toBe("McpUiError");
+    expect(json.code).toBe("TEST");
+    expect(json.message).toBe("test");
+    expect(json.context).toEqual({ server: "s1" });
+    expect(json.recoveryHint).toBe("hint");
+    expect(json.stack).toBeDefined();
+  });
+});
+
+describe("ResourceFetchError", () => {
+  it("formats message correctly", () => {
+    const error = new ResourceFetchError("ui://test/resource", "not found", {
+      server: "test-server",
+    });
+
+    expect(error.message).toBe(
+      'Failed to fetch UI resource "ui://test/resource": not found'
+    );
+    expect(error.code).toBe("RESOURCE_FETCH_ERROR");
+    expect(error.context.uri).toBe("ui://test/resource");
+    expect(error.context.server).toBe("test-server");
+    expect(error.recoveryHint).toContain("Check that the MCP server");
+  });
+
+  it("includes cause", () => {
+    const cause = new Error("network error");
+    const error = new ResourceFetchError("ui://test", "failed", { cause });
+
+    expect(error.cause).toBe(cause);
+  });
+});
+
+describe("ResourceParseError", () => {
+  it("formats message correctly", () => {
+    const error = new ResourceParseError("ui://test", "invalid HTML", {
+      server: "test-server",
+      mimeType: "text/plain",
+    });
+
+    expect(error.message).toBe('Invalid UI resource "ui://test": invalid HTML');
+    expect(error.code).toBe("RESOURCE_PARSE_ERROR");
+    expect(error.context.mimeType).toBe("text/plain");
+  });
+});
+
+describe("BridgeConnectionError", () => {
+  it("formats message correctly", () => {
+    const error = new BridgeConnectionError("timeout", { session: "abc123" });
+
+    expect(error.message).toBe("AppBridge connection failed: timeout");
+    expect(error.code).toBe("BRIDGE_CONNECTION_ERROR");
+    expect(error.context.session).toBe("abc123");
+    expect(error.recoveryHint).toContain("browser console");
+  });
+});
+
+describe("ConsentError", () => {
+  it("creates denial error", () => {
+    const error = new ConsentError("test-server", { denied: true });
+
+    expect(error.message).toBe(
+      'Tool calls for "test-server" were denied for this session'
+    );
+    expect(error.code).toBe("CONSENT_DENIED");
+    expect(error.denied).toBe(true);
+    expect(error.recoveryHint).toContain("Start a new session");
+  });
+
+  it("creates requires approval error", () => {
+    const error = new ConsentError("test-server", { requiresApproval: true });
+
+    expect(error.message).toBe('Tool call approval required for "test-server"');
+    expect(error.code).toBe("CONSENT_REQUIRED");
+    expect(error.denied).toBe(false);
+    expect(error.recoveryHint).toContain("Prompt the user");
+  });
+});
+
+describe("SessionError", () => {
+  it("formats message correctly", () => {
+    const error = new SessionError("expired", { session: "xyz789" });
+
+    expect(error.message).toBe("Session error: expired");
+    expect(error.code).toBe("SESSION_ERROR");
+    expect(error.context.session).toBe("xyz789");
+  });
+});
+
+describe("ServerError", () => {
+  it("formats message correctly", () => {
+    const error = new ServerError("port in use", { port: 3000 });
+
+    expect(error.message).toBe("UI server error: port in use");
+    expect(error.code).toBe("SERVER_ERROR");
+    expect(error.context.port).toBe(3000);
+    expect(error.recoveryHint).toContain("port is available");
+  });
+});
+
+describe("McpServerError", () => {
+  it("formats message correctly", () => {
+    const error = new McpServerError("my-server", "connection lost", {
+      tool: "test-tool",
+    });
+
+    expect(error.message).toBe('MCP server "my-server" error: connection lost');
+    expect(error.code).toBe("MCP_SERVER_ERROR");
+    expect(error.context.server).toBe("my-server");
+    expect(error.context.tool).toBe("test-tool");
+  });
+});
+
+describe("wrapError", () => {
+  it("passes through McpUiError with merged context", () => {
+    const original = new McpUiError("original", {
+      code: "ORIGINAL",
+      context: { server: "s1" },
+    });
+
+    const wrapped = wrapError(original, { tool: "t1" });
+
+    expect(wrapped.code).toBe("ORIGINAL");
+    expect(wrapped.context.server).toBe("s1");
+    expect(wrapped.context.tool).toBe("t1");
+  });
+
+  it("wraps standard Error", () => {
+    const original = new Error("standard error");
+    const wrapped = wrapError(original, { server: "test" });
+
+    expect(wrapped.code).toBe("UNKNOWN_ERROR");
+    expect(wrapped.message).toBe("standard error");
+    expect(wrapped.cause).toBe(original);
+    expect(wrapped.context.server).toBe("test");
+  });
+
+  it("wraps string error", () => {
+    const wrapped = wrapError("string error");
+
+    expect(wrapped.code).toBe("UNKNOWN_ERROR");
+    expect(wrapped.message).toBe("string error");
+  });
+
+  it("wraps unknown value", () => {
+    const wrapped = wrapError(42);
+
+    expect(wrapped.code).toBe("UNKNOWN_ERROR");
+    expect(wrapped.message).toBe("42");
+  });
+});
+
+describe("isErrorCode", () => {
+  it("returns true for matching code", () => {
+    const error = new McpUiError("test", { code: "MY_CODE" });
+    expect(isErrorCode(error, "MY_CODE")).toBe(true);
+  });
+
+  it("returns false for non-matching code", () => {
+    const error = new McpUiError("test", { code: "MY_CODE" });
+    expect(isErrorCode(error, "OTHER_CODE")).toBe(false);
+  });
+
+  it("returns false for non-McpUiError", () => {
+    const error = new Error("regular error");
+    expect(isErrorCode(error, "ANY_CODE")).toBe(false);
+  });
+
+  it("returns false for null/undefined", () => {
+    expect(isErrorCode(null, "ANY_CODE")).toBe(false);
+    expect(isErrorCode(undefined, "ANY_CODE")).toBe(false);
+  });
+});

package/mcp/__tests__/fixtures/elicitation-server.mjs

@@ -0,0 +1,98 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ElicitResultSchema,
+  ListResourcesRequestSchema,
+  ListToolsRequestSchema,
+  ReadResourceRequestSchema,
+  UrlElicitationRequiredError,
+} from "@modelcontextprotocol/sdk/types.js";
+
+const server = new Server(
+  { name: "elicitation-integration-server", version: "1.0.0" },
+  { capabilities: { tools: {}, resources: {} } },
+);
+
+function urlRequiredError() {
+  return new UrlElicitationRequiredError([{
+    mode: "url",
+    message: "Connect your account",
+    elicitationId: "required-1",
+    url: "https://example.com/connect",
+  }]);
+}
+
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [
+    { name: "capabilities", inputSchema: { type: "object", properties: {} } },
+    { name: "form", inputSchema: { type: "object", properties: {} } },
+    { name: "url", inputSchema: { type: "object", properties: {} } },
+    { name: "url-required", inputSchema: { type: "object", properties: {} } },
+  ],
+}));
+
+server.setRequestHandler(ListResourcesRequestSchema, async () => ({
+  resources: [
+    { name: "URL-required resource", uri: "test://url-required" },
+    { name: "URL-required UI resource", uri: "ui://url-required" },
+  ],
+}));
+
+server.setRequestHandler(ReadResourceRequestSchema, async request => {
+  if (request.params.uri === "test://url-required" || request.params.uri === "ui://url-required") {
+    throw urlRequiredError();
+  }
+  return { contents: [] };
+});
+
+server.setRequestHandler(CallToolRequestSchema, async request => {
+  if (request.params.name === "capabilities") {
+    return {
+      content: [{ type: "text", text: JSON.stringify(server.getClientCapabilities()?.elicitation ?? null) }],
+    };
+  }
+
+  if (request.params.name === "url-required") throw urlRequiredError();
+
+  if (request.params.name === "form") {
+    const result = await server.request({
+      method: "elicitation/create",
+      params: {
+        mode: "form",
+        message: "Provide a name",
+        requestedSchema: {
+          type: "object",
+          properties: { name: { type: "string", minLength: 1 } },
+          required: ["name"],
+        },
+      },
+    }, ElicitResultSchema);
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  }
+
+  if (request.params.name === "url") {
+    const result = await server.request({
+      method: "elicitation/create",
+      params: {
+        mode: "url",
+        message: "Connect your account",
+        elicitationId: "requested-1",
+        url: "https://example.com/authorize",
+      },
+    }, ElicitResultSchema);
+    if (result.action === "accept") {
+      for (const elicitationId of ["unknown", "requested-1", "requested-1"]) {
+        await server.notification({
+          method: "notifications/elicitation/complete",
+          params: { elicitationId },
+        });
+      }
+    }
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  }
+
+  throw new Error(`Unknown tool: ${request.params.name}`);
+});
+
+await server.connect(new StdioServerTransport());

package/mcp/__tests__/host-html-template.upstream-test.ts

@@ -0,0 +1,278 @@
+import { describe, it, expect } from "vitest";
+import { buildHostHtmlTemplate, type HostHtmlTemplateInput } from "../host-html-template.ts";
+
+function createMinimalInput(overrides: Partial<HostHtmlTemplateInput> = {}): HostHtmlTemplateInput {
+  return {
+    sessionToken: "test-token-123",
+    serverName: "test-server",
+    toolName: "test-tool",
+    toolArgs: { arg1: "value1" },
+    resource: {
+      uri: "ui://test/widget",
+      html: "<h1>Test Widget</h1>",
+      mimeType: "text/html",
+      meta: {},
+    },
+    allowAttribute: "",
+    requireToolConsent: false,
+    cacheToolConsent: true,
+    ...overrides,
+  };
+}
+
+describe("buildHostHtmlTemplate", () => {
+  describe("structure", () => {
+    it("generates valid HTML document", () => {
+      const html = buildHostHtmlTemplate(createMinimalInput());
+
+      expect(html).toContain("<!doctype html>");
+      expect(html).toContain("<html lang=\"en\">");
+      expect(html).toContain("</html>");
+    });
+
+    it("includes title with server and tool name", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ serverName: "my-server", toolName: "my-tool" })
+      );
+
+      expect(html).toContain("<title>MCP UI - my-server / my-tool</title>");
+    });
+
+    it("includes header with server and tool info", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ serverName: "demo-server", toolName: "widget-tool" })
+      );
+
+      expect(html).toContain('id="server-name"');
+      expect(html).toContain('id="tool-name"');
+      expect(html).toContain("Sandboxed");
+    });
+
+    it("includes iframe for app content", () => {
+      const html = buildHostHtmlTemplate(createMinimalInput());
+
+      expect(html).toContain('<iframe id="mcp-app"');
+      expect(html).toContain('referrerpolicy="no-referrer"');
+    });
+
+    it("includes control buttons", () => {
+      const html = buildHostHtmlTemplate(createMinimalInput());
+
+      expect(html).toContain('id="done-btn"');
+      expect(html).toContain('id="cancel-btn"');
+    });
+  });
+
+  describe("data injection", () => {
+    it("injects session token", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ sessionToken: "secret-token-xyz" })
+      );
+
+      expect(html).toContain('"secret-token-xyz"');
+    });
+
+    it("injects tool arguments", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ toolArgs: { location: "NYC", units: "metric" } })
+      );
+
+      expect(html).toContain('"location"');
+      expect(html).toContain('"NYC"');
+      expect(html).toContain('"units"');
+      expect(html).toContain('"metric"');
+    });
+
+    it("injects host context", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({
+          hostContext: {
+            displayMode: "fullscreen",
+            theme: "dark",
+          },
+        })
+      );
+
+      expect(html).toContain('"displayMode"');
+      expect(html).toContain('"fullscreen"');
+      expect(html).toContain('"theme"');
+      expect(html).toContain('"dark"');
+    });
+
+    it("escapes HTML in injected values", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({
+          toolArgs: { script: "<script>alert('xss')</script>" },
+        })
+      );
+
+      // Should be escaped
+      expect(html).not.toContain("<script>alert");
+      expect(html).toContain("\\u003cscript\\u003e");
+    });
+  });
+
+  describe("consent handling", () => {
+    it("injects requireToolConsent=false", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ requireToolConsent: false })
+      );
+
+      expect(html).toContain("const REQUIRE_TOOL_CONSENT = false");
+    });
+
+    it("injects requireToolConsent=true", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ requireToolConsent: true })
+      );
+
+      expect(html).toContain("const REQUIRE_TOOL_CONSENT = true");
+    });
+
+    it("injects cacheToolConsent", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ cacheToolConsent: false })
+      );
+
+      expect(html).toContain("const CACHE_TOOL_CONSENT = false");
+    });
+
+    it("records explicit consent denials", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ requireToolConsent: true })
+      );
+
+      expect(html).toContain('await post("/proxy/ui/consent", { approved: false }).catch(() => {});');
+      expect(html).toContain("Tool call denied by user.");
+    });
+  });
+
+  describe("iframe permissions", () => {
+    it("sets allow attribute when provided", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ allowAttribute: "camera; microphone" })
+      );
+
+      expect(html).toContain('const ALLOW_ATTRIBUTE = "camera; microphone"');
+    });
+  });
+
+  describe("CSP handling", () => {
+    it("buildCspMetaContent generates correct CSP directives", async () => {
+      const { buildCspMetaContent } = await import("../host-html-template.ts");
+      const csp = buildCspMetaContent({
+        scriptDomains: ["'self'", "cdn.example.com"],
+        styleDomains: ["'self'"],
+      });
+
+      expect(csp).toContain("script-src 'self' cdn.example.com");
+      expect(csp).toContain("style-src 'self'");
+      expect(csp).toContain("default-src 'none'");
+    });
+
+    it("applyCspMeta injects CSP meta into HTML head", async () => {
+      const { applyCspMeta } = await import("../host-html-template.ts");
+      const html = applyCspMeta(
+        "<html><head></head><body>Content</body></html>",
+        "default-src 'none'; script-src 'self'"
+      );
+
+      expect(html).toContain("Content-Security-Policy");
+      expect(html).toContain("script-src");
+    });
+
+    it("applyCspMeta preserves existing CSP in resource HTML", async () => {
+      const { applyCspMeta } = await import("../host-html-template.ts");
+      const resourceWithCsp = `<html>
+        <head>
+          <meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+        </head>
+        <body>Content</body>
+      </html>`;
+
+      const html = applyCspMeta(resourceWithCsp, "script-src 'self'");
+
+      // Should not duplicate CSP meta - applyCspMeta should detect existing CSP and skip injection
+      const cspMatches = html.match(/Content-Security-Policy/g) ?? [];
+      expect(cspMatches.length).toBe(1);
+    });
+  });
+
+  describe("module loading", () => {
+    it("uses default AppBridge module URL", () => {
+      const html = buildHostHtmlTemplate(createMinimalInput());
+
+      expect(html).toContain("/app-bridge.bundle.js");
+    });
+
+    it("uses custom AppBridge module URL when provided", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({
+          appBridgeModuleUrl: "https://cdn.example.com/app-bridge.js",
+        })
+      );
+
+      expect(html).toContain("https://cdn.example.com/app-bridge.js");
+    });
+  });
+
+  describe("stream mode", () => {
+    it("registers the stream patch notification method", () => {
+      const html = buildHostHtmlTemplate(createMinimalInput());
+
+      expect(html).toContain('const STREAM_PATCH_METHOD = "notifications/pi-mcp-adapter/ui-result-patch"');
+      expect(html).toContain('eventSource.addEventListener("result-patch"');
+      expect(html).toContain("bridge.notification({");
+    });
+
+    it("skips initial tool input in stream-first mode", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({
+          hostContext: {
+            "pi-mcp-adapter/stream": {
+              mode: "stream-first",
+              streamId: "stream-1",
+              intermediateResultPatches: true,
+              partialInput: false,
+            },
+          },
+        }),
+      );
+
+      expect(html).toContain('const streamMode = initialStreamContext?.mode === "stream-first" ? "stream-first" : "eager";');
+      expect(html).toContain('if (streamMode !== "stream-first") {');
+      expect(html).toContain('bridge.sendToolInput({ arguments: TOOL_ARGS });');
+    });
+  });
+
+  describe("XSS prevention", () => {
+    it("escapes server name in title", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ serverName: "<script>evil</script>" })
+      );
+
+      expect(html).toContain("&lt;script&gt;evil&lt;/script&gt;");
+      expect(html).not.toContain("<script>evil</script>");
+    });
+
+    it("escapes tool name in title", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({ toolName: '<img onerror="alert(1)">' })
+      );
+
+      expect(html).toContain("&lt;img onerror=");
+    });
+
+    it("escapes unicode line/paragraph separators", () => {
+      const html = buildHostHtmlTemplate(
+        createMinimalInput({
+          toolArgs: { text: "line\u2028separator\u2029here" },
+        })
+      );
+
+      // Should be escaped to prevent JS parsing issues
+      expect(html).toContain("\\u2028");
+      expect(html).toContain("\\u2029");
+    });
+  });
+});